Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> writes:
> FWIW, I think that Java clients don't need to worry about those security
> issues. It's not possible for Java to emit an invalidly-coded UTF8
> string, is it? I thought that the internal representation of strings
> is UCS2 or UCS4, and if so, it would take some exceedingly broken
> code in the JVM for the output not to be valid UTF8.
It's UTF-16, just like Windows XP and above.
http://java.sun.com/developer/technicalArticles/Intl/Supplementary/
FYI there are two ways to output UTF8:
DataOutputStream.writeUTF()
outputs a non-standard UTF8, and is limited in size.
>From 1.4:
Charset.forName("UTF-8")....encode()
outputs standard UTF8